1. Scope and services covered

This policy applies to ieta.in and IETA-branded services that link to it, including IETA Universal Identity, IETA Marketplace and listing services, IETA Campus, IETA RideOS, IETA Connector, IETA Academy, IETA Skills, IETA HeartBeat, IETA Sports, support services, mobile or desktop applications, and future IETA products. A product or institution may provide an additional notice when a feature needs more specific information.

“IETA Services” means these current and future services together. Third-party websites and services have their own privacy practices.

2. Who is responsible for the data

IETA operates the shared identity, product software and supporting infrastructure. Schools, academies, riding schools, sellers and other organisations using IETA may decide why and how their own operational records are created and used. Depending on the service, IETA may act for its own purposes, as a service provider to an organisation, or alongside another responsible organisation. Requests about a school, riding-school or marketplace record may therefore need to be handled by the organisation that created it.

3. Personal data we may process

4. Sources of data

Data may come directly from you; from a parent, guardian or authorised representative; from a school, academy, riding school, seller or other organisation; from another IETA product at the organisation’s instruction; from a connected service such as Google, WhatsApp, Telegram or a payment provider; or from technical use of the service. IETA does not use a product connection to expose operational data to an unrelated product or unauthorised person.

5. Why we process personal data

• To create, verify and secure an IETA account and complete product-specific sign-in.
• To provide the service, maintain authorised relationships and display the correct account, institution, child, listing or operational record.
• To manage listings, enquiries, bookings, learning, attendance, payments, subscriptions, documents, reports, support and communications.
• To obtain and record consent where required, provide notices, and honour account or communication choices.
• To prevent fraud, duplicate or unauthorised accounts, misuse, data leakage and security incidents.
• To diagnose errors, maintain availability, improve accessibility and understand service performance.
• To enforce agreements, protect users and institutions, establish or defend legal claims, and comply with applicable law.

We rely on consent where law requires it. Other processing may be necessary to provide a requested service, perform an agreement, comply with law, protect legitimate interests and safety, or carry out another use permitted by applicable law. Consent can be withdrawn for future processing where consent is the basis, subject to data that must still be retained or processed lawfully.

6. Children, students and guardian consent

IETA Services may process children’s information for education, training, family communication and related services. Access must be based on a verified or institution-approved relationship. The responsible institution must provide required notices and obtain verifiable consent from a parent or lawful guardian where applicable before enabling processing. IETA Services must not be used for tracking, behavioural advertising or processing likely to cause a detrimental effect on a child.

Children must not independently create seller, payment or institution-administrator accounts unless legally permitted and properly authorised. A parent, guardian or institution may ask for correction or removal of a child’s information, subject to safeguarding, academic, financial and other lawful retention duties.

7. Cookies, sessions and similar technology

We use essential cookies and local storage for authentication, security, product routing, language, preferences and session continuity. Analytics or marketing technologies, where used, should be separately disclosed and offered with choices required by law. Blocking essential cookies may prevent secure login or use of protected product features.

8. When data may be shared

We share data only as needed with the organisation controlling the relevant record; authorised family members or users; IETA products participating in an approved connection; hosting, cloud, security, authentication, communications, analytics, support and payment providers; professional advisers; a successor in a lawful business transaction; or regulators, courts and authorities when legally required. Providers receive only the access needed for their service and are expected to protect the information.

External services such as Google, Meta/WhatsApp, Telegram, payment gateways and app stores process information under their own terms when enabled. IETA does not sell personal data or student information.

9. International processing

IETA or its service providers may process information outside the user’s state or country. Where applicable, we use contractual, organisational and technical safeguards and follow restrictions notified under Indian law or another applicable jurisdiction.

10. Retention and deletion

We retain personal data only for the period reasonably required for the stated purpose, the organisation’s documented operational needs, account security, fraud prevention, support, financial records, dispute resolution, backups and legal compliance. Retention differs by record type and product. When data is no longer required, it is deleted, anonymised or access-restricted. Removing an IETA account does not automatically erase a lawful institution, transaction or safety record controlled by another organisation.

Connector projections and delivery records are not a second authoritative copy of Campus or RideOS operations. The source institution remains responsible for the underlying booking, fee, attendance, education or riding record and its retention schedule.

11. Security and incident response

Safeguards may include encrypted transport, protected credentials, registered callbacks, state and PKCE validation, secure cookies, least-privilege product accounts, tenant and relationship checks, private cache controls, rate limiting, backups, audit logging and restricted administrative access. No service can guarantee absolute security. Suspected compromise should be reported immediately so sessions can be revoked and appropriate investigation, containment and notification steps can be taken.

12. Your choices and rights

Subject to applicable law, you may ask for a summary of personal data and processing, access to relevant information, correction, completion or updating, erasure, consent withdrawal, communication preference changes and grievance redressal. You may also nominate another person to exercise applicable rights in the event of death or incapacity. We may verify identity and authority before acting.

For school, riding-school, marketplace or other organisation-controlled records, contact that organisation first. For central identity or IETA-controlled records, use the contact below. Some information cannot be deleted immediately where retention is required for law, safety, payment, fraud prevention, dispute resolution or another permitted purpose.

13. Automated tools and artificial intelligence

Some IETA features may use automated tools to organise, summarise, recommend or help create content. Material decisions affecting access, safety, education, payments or legal rights should remain subject to appropriate human review. Product-specific notices should explain material AI use and available controls. Personal data must not be used to train a general model unless this is lawfully permitted and clearly disclosed.

14. Applicable law and regulatory requests

IETA intends to handle personal data in accordance with applicable privacy, information-technology, education, consumer, financial-record and cybersecurity requirements. For users and operations in India, this may include the Digital Personal Data Protection Act, 2023 and related rules as their provisions become applicable, together with lawful directions issued under the Information Technology Act, 2000. Nothing in this policy limits a person’s right to approach an appropriate regulator or statutory grievance channel. IETA may need to preserve or disclose narrowly relevant information when required by a valid legal or regulatory process.

15. Changes to this policy

We may update this policy when products, providers, processing activities or legal requirements change. Material changes will be communicated through an appropriate website, application, email or service notice. The effective date identifies the currently published version.